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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 

Listing of Claims; 

1. (Currently Amended) A smart card device for 
communication with an electronic device, comprising: 

a memory, on said smart card device , storing therein 
(1) an application program; (2) a security manager; and 
(3) a capabilities list associated with said application 
program, said capabilities list including information 
regarding whether access to one or more resources for use 
by said application program is permitted; and 

a processing unit, on said smart card device , for 
executing said application program and said security 
manager, 

wherein upon said processing unit executing said 
application and said security manager, and when said 
executing application requests access to at least one 
of said one or more resources, said executing 
security manager selectively grants access to said at 
least one of said one or more resources for use by 
said executing application program based at least in 
part on said information in said capabilities list. 

2. (Currently Amended) The smart card device of claim 1 
wherein said one or more resources comprise at least one of 
data and functions. 

3. (Currently Amended) The smart card device of claim 1 
wherein said one or more resources comprise one or more 
resources external to said smart card device . 
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4. (Currently Amended) The smart card device of claim 3, 
further comprising at least one of: 

terminal side resources; and 
channels of a communications network. 

5. (Currently Amended) The smart card device of claim 1 
wherein said one or more resources comprise one or more 
resources owned by at least one of said application program and 
another entity. 

6. (Currently Amended) The smart card device of claim 5 
wherein said other entity comprises at least one of: 

an operating system of said smart card device ; and 
another application program. 

7. (Currently Amended) The smart card device of claim 1 
wherein said information in said capabilities list comprises 
information regarding at least one of: 

access rights; and 

information required for access to a resource. 

8. (Currently Amended) The smart card device of claim 1 
wherein said capabilities list comprises a first capabilities 
list and said memory also stores a second capabilities list, 
said first capabilities list comprising a handle to link to 
said second capabilities list. 

9. (Currently Amended) The smart card device of claim 8 
wherein said second capabilities list is associated with one or 
more of other application programs. 

10. (Currently Amended) The smart card device of claim 1 
wherein said application program is for requesting access to a 
resource . 
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11. (Currently Amended) The smart card device of claim 1 
wherein 

said application program is for transmitting a resource 
access request to said security manager; and 

said security manager is for transmitting a verify 
request to a verification program to examine said 
capabilities list to determine whether said application 
program is authorized to access said resource, and for 
performing or denying said requested action based at least 
in part on said examination. 

12. (Currently Amended) The smart card device of claim 
11 wherein said security manager comprises an application 
program interface (API) . 

13. (Currently Amended) The smart card device of claim 
11 wherein said security manager is for obtaining information 
regarding said requesting application program through one of 
inquiring at a context originating the resource access request 
and a parameter provided with said resource access request . 

14. (Currently Amended) The smart card device of claim 
1, further comprising input /output means for receiving said 
capabilities list from at least one of a provider of said 
application program and an owner of said one or more resources. 

15. (Currently Amended) The smart card device of claim 1 
wherein said capabilities list and said application program 
constitute a load package received by said smart card device . 

16. (Currently Amended) The smart card device of claim 1 
wherein said device is configured to modify said capabilities 
list based at least in part on a subsequently received 
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capabilities update list associated with said application 
program. 

17. (Currently Amended) The smart card device of claim 1 
wherein said smart card device is configured to delete said 
capabilities list or link and access rights upon receiving an 
instruction to delete said application program from the 
outside. 



18. 
wherein 



(Currently Amended) The smart card device of claim 1 



said capabilities list is encrypted; and 
said processor is configured to decrypt said 
capabilities list . 



19. 
wherein 



(Currently Amended) The smart card device of claim 1 



said capabilities list is cryptographically signed by 
at least one of a provider of said application program and 
an owner of said one or more resources; and 

said processor is configured to cryptographically 
authenticate said capabilities list. 

20. (Currently Amended) The smart card device of claim 
19 wherein said processor is further configured to 
cryptographically authenticate said capabilities list when said 
capabilities list is stored on said device. 
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21. (Currently Amended) The smart card device of claim 
19 wherein said processor is further configured to 
cryptographically authenticate said capabilities list when said 
capabilities list is accessed, said capabilities list being 
successfully authenticated if a first fingerprint computed over 
said capabilities list upon storing capabilities list matches a 
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second fingerprint computed over said capabilities list in 
response to a run-time request to use said capabilities list. 

22. (Currently Amended) The smart card device of claim 1 
wherein said application program comprises a plurality of 
modules . 

23. (Currently Amended) The smart card device of claim 1 
wherein said application program comprises a Java application 
program or a Java Card™ applet . 

24. (Currently Amended) The smart card device of claim 1 
wherein said capabilities list is embodied in a tag-length- 
value (TLV) structure. 

25. (Currently Amended) A method for controlling a smart 
card device , the smart card device for communication with an 
electronic device, the method comprising: 

storing, on said smart card device , an application 
program; 



list associated with said application program, said 
capabilities list comprising information regarding whether 
access to one or more resources for use by said 
application program is permitted; and 

executing, on said smart card device , said 
application program and a security manager, 

wherein upon said executing application 
requesting access to at least one of said one or more 
resources, said exeucting security manager 
selectively grants access to said at least one of 
said one or more resources for use by said 
application program based at least in part on said 
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26. (Original) The method of claim 2 5 wherein said one 
or more resources comprise at least one of data and functions 

27. (Currently Amended) The method of claim 25 wherein 
said one or more resources comprise one or more resources 
external to said smart card device . 



28. (Currently Amended) The method of claim 27 wherein 
said smart card device further comprises at least one of: 

terminal side resources; and 
channels of a communications network. 

29. (Original) The method of claim 25 wherein said one 
or more resources comprise one or more resources owned by at 
least one of said application program and another entity. 



30. (Currently Amended) The method of claim 29 wherein 
said other entity comprises at least one of: 

an operating system of said smart card device ; and 
another application program. 

31. (Previously Presented) The method of claim 25 
wherein said information in said capabilities list comprises 
information regarding at least one of: 

access rights; and 

information required for access to a resource. 
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32. (Currently Amended) The method of claim 25 wherein 
said capabilities list comprises a first capabilities list and 
said method further comprises: 

storing, on said smart card device , a second 
capabilities list, said first capabilities list comprising 
a handle to link to said second capabilities list. 
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33. (Currently Amended) The card dcvicc method of claim 
32 wherein said second capabilities list is associated with one 
or more of other application programs. 

34. (Original) The method of claim 25 wherein said 
executing further comprises said application program requesting 
access to a resource. 



35. (Original) The method of claim 25 wherein said 
executing further comprises: 

said application program transmitting a resource access 
request to said security manager; and 

said security manager transmitting a verify request to 
a verification program to examine said capabilities list to 
determine whether said application program is authorized to 
access said resource, and performing or denying the!j 
requested action based at least in part on said examination. 

36. (Original) The method of claim 35 wherein said 
security manager comprises an application program interface 
(API) . 



37. (Previously Presented) The method of claim 35 
wherein said security manager obtains information regarding 
said requesting application program through at least one of 
inquiring at a context originating said resource access 
request, and a parameter provided with said resource access 
request . 
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38. (Original) The method of claim 25, further 
comprising receiving said capabilities list from at least one 
of a provider of said application program and an owner of said 
one or more resources . 
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39. (Currently Amended) The method of claim 25 wherein 
said capabilities list and said application program are 
comprised in a load package received by said smart card device . 

40. (Original) The method of claim 25, further 
comprising modifying said capabilities list based at least in 
part on a subsequently received capabilities update list 
associated with said application program. 

41. (Original) The method of claim 25, further 
comprising deleting said capabilities list or link and access 
rights upon receiving an instruction to delete said application 
program from the outside. 

. }: 42. (Original) The method of claim 25 wherein H . 
said capabilities list is encrypted; and 
said method further comprises decrypting said 
capabilities list. 

43. (Original) The method of claim 25 wherein 

said capabilities list is cryptographically signed by 
at least one of a provider of said application program and 
an owner of said one or more resources; and 

said method further comprises cryptographically 
authenticating said capabilities list. 

44. (Original) The method of claim 25, further 
comprising cryptographically authenticating said capabilities 
list when said capabilities list is stored on said device. 



45. (Original) The method of claim 25, further 
comprising cryptographically authenticating said capabilities 
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list being successfully authenticated if a first fingerprint 
computed over said capabilities list upon storing capabilities 
list matches a second fingerprint computed over said 
capabilities list in response to a run-time request to use said 
capabilities list . 

46. (Original) The method of claim 25 wherein said 
application program comprises a plurality of modules 

47. (Original) The method of claim 25 wherein said 
application program comprises a Java application program or a 
Java Card™ applet . 

48. (Original) The method of claim 25 wherein said 
capabilities list is embodied in a tag-length-value (TLV) 
structure. • • 
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49. (Currently Amended) A program, storage device 
readable by a machine, embodying a program of instructions ;, 
executable by the machine to perform a method for controlling a 
smart card device , the smart card device for communication with 
an electronic device, the method comprising: 

storing, on said smart card device , an application 

program; 

storing, on said smart card device , a capabilities 
list associated with said application program, said 
capabilities list comprising information regarding whether 
access to one or more resources for use by said 
application program is permitted; and 

executing, on said smart card device , said 
application program and a security manager, 

wherein upon said executing application 

requesting access to at least one of said one or more 

resources, said exeucting security manager 
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selectively grants access to said at least one of 
said one or more resources for use by said 
application program based at least in part on said 
information in said capabilities list. 



50. (Original) The program storage device of claim 49 
wherein said one or more resources comprise at least one of 
data and functions. 



51. (Currently Amended) The program storage device of 
claim 4 9 wherein said one or more resources comprise one or 
more resources external to said smart card device . 



52. (Currently Amended) The program storage device of 
claim 51 wherein said smart card device further comprises at 
least one of : 

terminal side resources; and 

channels of a communications network. !i ,; 

i 

53. (Original) The program storage device of claim 4 9 
wherein said one or more resources comprise one or more 
resources owned by at least one of said application program and 
another entity. 

54. (Currently Amended) The program storage device of 
claim 53 wherein said other entity comprises at least one of: 

an operating system of said smart card device ; and 
another application program. 
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55. (Previously Presented) The program storage device of 
claim 49 wherein said information in said capabilities list 
comprises information regarding at least one of: 
access rights; and 

information required for access to a resource. 
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56. (Currently Amended) The program storage device of 
claim 49 wherein said capabilities list comprises a first 
capabilities list and said method further comprises: 

storing, on said smart card device , a second 
capabilities list, said first capabilities list comprising 
a handle to link to said second capabilities list. 

57. (Original) The program storage device of claim 56 
wherein said second capabilities list is associated with one or 
more of other application programs. 

58. (Original) The program storage device of claim 49 
wherein said executing further comprises said application 
program requesting access to a resource; and 

t ' 59. (Original) The program storage device of claim 4,9 
wherein- said executing further comprises: : j 

I said application program transmitting a resource ' 

access request to said security manager; and 

said security manager transmitting a verify request 
to a verification program to examine said capabilities 
list to determine whether said application program is 
authorized to access said resource, and performing or 
denying the requested action based at least in part on 
said examination. 



60. (Original) The program storage device of claim 59 
wherein said security manager comprises an application program 
interface (API) . 
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61. (Previously Presented) The program storage device of 
claim 59 wherein said security manager obtains information 
regarding said requesting application program through at least 
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one of inquiring at a context originating said resource access 
request, and a parameter provided with said resource access 
request . 

62. (Original) The program storage device of claim 49, 
said method further comprising receiving said capabilities list 
from at least one of a provider of said application program and 
an owner of said one or more resources. 



63. (Currently Amended) The program storage device of 
claim 49 wherein said capabilities list and said application 
program are comprised in a load package received by said smart 
car d device . 

64. (Original) The program storage device of claim 49, 
said method further comprising modifying said capabilities list 
based at least in part on a subsequently received capabilities 
update list associated: with said application program, j ;r 

65. (Original) The program storage device of claim 49, 
said method further comprising deleting said capabilities list 
or link and access rights upon receiving an instruction to 
delete said application program from the outside. 

66. (Original) The program storage device of claim 49 
wherein 

said capabilities list is encrypted; and 
said method further comprises decrypting said 
capabilities list . 

67. (Original) The program storage device of claim 49 
wherein 
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said capabilities list is cryptographically signed by 
at least one of a provider of said application program and 
an owner of said one or more resources; and 

said method further comprises cryptographically 
authenticating said capabilities list. 

68. (Original) The program storage device of claim 67, 
said method further comprising cryptographically authenticating 
said capabilities list when said capabilities list is stored on 
said device. 

69. (Original) The program storage device of claim 67, 
said method further comprising cryptographically authenticating 
said capabilities list when said capabilities list is accessed, 
said capabilities list being successfully authenticated if a 
first fingerprint computed over said capabilities list upon 
storing capabilities list matches a second fingerprint computed 
over said capabilities list in response to a run-time request 
to use said capabilities list. 

70. (Original) The program storage device of claim 49 
wherein said application program comprises a plurality of 
modules . 

71. (Original) The program storage device of claim 49 
wherein said application program comprises a Java application 
program or a Java Card™ applet. 

72. (Original) The program storage device of claim 49 
wherein said capabilities list is embodied in a tag-length- 
value (TLV) structure. 
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73. (Currently Amended) An apparatus for controlling a 
smart card device , the smart card device for communication with 
an electronic device, the apparatus comprising: 

means for storing, on said smart card device , an 
application program; 

means for storing, on said smart card device , a 
capabilities list associated with said application 
program, said capabilities list comprising information 
regarding whether access to one or more resources for use 
by said application program is permitted; and 

means for executing, on said smart card device , said 
application program and a security manager, 

wherein upon said executing application 
requesting access to at least one of said one or more 
resources, said exeucting security manager 
selectively grants: access to said at least one of 
said one or ;. more resources for use by said 
application program based at least in part on said 
information in said .capabilities list. 

74. (Original) The apparatus of claim 73 wherein said 
one or more resources comprise at least one of data and 
functions . 



75. (Currently Amended) The apparatus of claim 73 
wherein said one or more resources comprise one or more 
resources external to said smart card device . 



76. (Currently Amended) The apparatus of claim 75 
wherein said smart card device further comprises at least one 
Of: 

terminal side resources; and 
channels of a communications network. 
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77. (Original) The apparatus of claim 73 wherein said 
one or more resources comprise one or more resources owned by 
at least one of said application program and another entity. 

78. (Currently Amended) The apparatus of claim 77 
wherein said other entity comprises at least one of: 

an operating system of said smart card device ; and 
another application program. 

79. (Previously Presented) The apparatus of claim 73 
wherein said information in said capabilities list comprises 
information regarding at least one of: 

access rights; and 

information required for access to a resource. 



80. (Currently Amended). The apparatus of claim 73 
wherein said capabilities list, comprises a first capabilities 
list and said apparatus, further comprises : 

means for storing, on said smart card device , a 

second capabilities list, said first capabilities list 

comprising a handle to link to said second capabilities 

list . 



81. (Currently Amended) The smart card device of claim 
80 wherein said second capabilities list is associated with one 
or more of other application programs. 

82. (Original) The apparatus of claim 73 wherein said 
means for executing further comprises said means for requesting 
access to a resource. 
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83. (Original) The apparatus of claim 73 wherein said 
means for executing further comprises: 
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said application program transmitting a resource access 
request to said security manager; and 

said security manager transmitting a verify request to 
a verification program to examine said capabilities list to 
determine whether said application program is authorized to 
access said resource, and performing or denying the 
requested action based at least in part on said examination. 

84. (Original) The apparatus of claim 73 wherein said 
security manager comprises an application program interface 
(API) . 

85. (Original) The apparatus of claim 73 wherein said 
security manager obtains information regarding said requesting 
application program through at least one of inquiring at a 
context originating said resource access /request , and a 
parameter provided with said resource access request . 

86. (Original) The apparatus of: claim 73, further 
comprising means for receiving said capabilities list from at 
least one of a provider of said application program and an 
owner of said one or more resources. 



87. (Currently Amended) 
wherein said capabilities list 
comprised by in a load package 
device . 



The apparatus of claim 73 

and said application program are 

received by said smart card 



88. (Original) The apparatus of claim 73, further 
comprising means for modifying said capabilities list based at 
least in part on a subsequently received capabilities update 
list associated with said application program. 
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89. (Original) The apparatus of claim 73, further 
comprising means for deleting said capabilities list or link 
and access rights upon receiving an instruction to delete said 
application program from the outside. 

90. (Previously Presented) The apparatus of claim 73 
wherein 

said capabilities list is encrypted; and 
said apparatus further comprises means for 
decrypting said capabilities list. 

91. (Currently Amended) The apparatus of claim 73 wherein 
said capabilities list is cryptographically signed by 

at least one of a provider of said application program and 
an owner of said one or more resources; and 

said apparatus further comprises means for 
cryptographically authenticating said capabilities list . 

92. (Original) The apparatus . of claim 91, further 
comprising means for cryptographically authenticating said 
capabilities list when said capabilities list is stored on said 
device . 



93. (Original) The apparatus of claim 91, further 
comprising means for cryptographically authenticating said 
capabilities list when said capabilities list is accessed, said 
capabilities list being successfully authenticated if a first 
fingerprint computed over said capabilities list upon storing 
capabilities list matches a second fingerprint computed over 
said capabilities list in response to a run-time request to use 
said capabilities list. 
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94. (Original) The apparatus of claim 73 wherein said 
application program comprises a plurality of modules 
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95. (Original) The apparatus of claim 73 wherein said 
application program comprises a Java application program or a 
Java Card™ applet. 

96. (Original) The apparatus of claim 73 wherein said 
capabilities list is embodied in a tag-length-value (TLV) 
structure . 

97. (Cancelled) 

98. (Cancelled) 

99. (Cancelled) . 

100 . (Cancelled) . 



GUNNISON, McKAY & 

HODGSON, L.L.P. 
Garden West Office Plaza 
1900 Garden Road. Suite 220 
Monterey. CA 93940 

(831)655-0880 
Fax (831) 655-0888 



Page 19 of 23 



